A form of Security Control that occurs after intrusion to reverse the impact of the event. Goal is to return to operating with minimal downtime.
- Restoring from backups to mitigate ransomware
- Create policies to report security issues
- Contacting law enforcement to manage criminal activity
- Fire extinguishers